Attach any file, take shares from other apps, and survive a backwards highlight

Attachments were images only. Now any file can be attached: from the file
chooser behind the "+" menu, or from Android's share sheet, which the app
is now in. An image still goes to the model as a picture; anything else is
stored under its own name (`<hex>-<name>`, cleaned by `safe_file_name`)
and the Claude driver ends the message with `Attached file: /abs/path`,
since the CLI reads files by path and a model cannot be shown a trace. The
user-message field is renamed `images` -> `attachments` on both sides,
with a serde alias reading the rows written before. A share arrives before
anyone has said which session it is for, so it is held in AppRoot with a
banner on the list until a session takes it; an open session takes it at
once. Unreadable shares are reported beside the composer, not thrown.

The tool card crashed the app when opened on a command holding a quoted
glob such as `-path '*/.git/*'`: highlights 1.1.0's shell lexer answers
`x '*/a/*'` with a span whose end is before its start, and AnnotatedString
refuses the range. Such spans are dropped; the library is the place for
the fix. The echo driver gains `/bash <command>` so a card with a given
command can be produced on the emulator.

ui-sandbox.sh's token salvage read the tokens block's close only at a line
start, ran past the compact `),],` the server writes, and copied `setups`
into the new config twice, which the server then refused.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

AGENTS.md

@@ -65,6 +65,19 @@ repo is in PLAN.md's "Backend layout" section.
   refuse to resume onto a partial from a different revision, and are
   checked against HuggingFace's published sha256 before the file gets its
   real name.
+- **Attachments** are one list on a user message (`attachments`, the
+  ref the files route serves), in two shapes. An image is `<hex>.<ext>`
+  and goes to the model as an image block. Anything else is
+  `<hex>-<name>` -- the name it was shared or picked under, cleaned by
+  `safe_file_name` -- and the Claude driver appends `Attached file:
+  /abs/path` to the message text, since the CLI reads files by path and
+  a model cannot be shown a trace. `media::media_type_for` on the server
+  and `isImageRef` on the phone tell the two apart; keep those lists
+  level. The phone attaches from the photo picker, the file chooser and
+  Android's share sheet (`Share.kt`; the manifest's SEND filter), all
+  through one `attach` path in `SessionScreen`. Files exist only on the
+  server's machine -- see PLAN.md's "Transport" for what that means for
+  remote sessions.
 - `server/` — Rust backend (`ai-server`). `main.rs` bootstraps (TLS, the
   auth layer, token/QR enrollment, wg0 binding), `routes.rs` has the HTTP
   table in its module doc comment, `auth.rs` the bearer-token middleware,